--- title: "The Frightening Math of Security Awareness Training | DuoCircle" description: "It’s everywhere you turn. Advertisements for security awareness training. The last line of defense. The human firewall." image: "https://www.duocircle.com/images/og-default.png" canonical: "https://www.duocircle.com/blog/email-hosting/the-frightening-math-of-security-awareness-training/" --- Quick Answer Security awareness training has a ceiling. KnowBe4 data shows continuous training across an entire year drops the phish-prone rate to about 2 percent at best. The average employee receives roughly five phishing emails per week, so a 10-person team with that 2 percent click rate gets roughly one successful phish per week. One successful phish is all it takes to deliver malware or steal credentials. Other research shows 1 in 4 employees know the security guidelines but ignore them, which makes the real ceiling higher than 2 percent in most environments. Training is worth running as the first line of defense, but cannot be the last. The last line is technology that catches the email before the user has a chance to click: anti-phishing email security with link rewriting and real-time scan-on-click. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Femail-hosting%2Fthe-frightening-math-of-security-awareness-training%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=The%20Frightening%20Math%20of%20Security%20Awareness%20Training&url=undefined%2Fblog%2Femail-hosting%2Fthe-frightening-math-of-security-awareness-training%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Femail-hosting%2Fthe-frightening-math-of-security-awareness-training%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Femail-hosting%2Fthe-frightening-math-of-security-awareness-training%2F&title=The%20Frightening%20Math%20of%20Security%20Awareness%20Training "Share on Reddit") [ ](mailto:?subject=The%20Frightening%20Math%20of%20Security%20Awareness%20Training&body=Check out this article: undefined%2Fblog%2Femail-hosting%2Fthe-frightening-math-of-security-awareness-training%2F "Share via Email") ![Security Awareness Training](https://media.mailhop.org/duocircle/images/2019/08/dmarc-report-5051.jpg) It’s everywhere you turn. Advertisements for **security awareness training**. _The last line of defense. The human firewall_. There’s nothing wrong with training your employees to recognize security exploits. We recommend it. But it should be one part of a holistic [defense-in-depth](https://en.wikipedia.org/wiki/Defense%5Fin%5Fdepth%5F%28computing%29) approach to security. Why is that? _Because the math of having employee awareness training be your only line of defense is frightening_. How frightening? Let’s assume your employees receive the best possible awareness training. Not only that, but they receive the training continuously for an entire year. Under these ideal conditions, the [phish prone percentage will get as low as 2%.](https://www.knowbe4.com/resources/point-of-failure-phishing-training-does-not-work/) That means links in 2% of the malicious emails will still get clicked on by your super-aware employees. Furthermore, recent [research](https://themerkle.com/phishing-attacks/) indicates that _the average employee receives almost five phishing emails per week_. Ready for some math? With thoroughly trained employees receiving an average number of **phishing emails**, a company with just 10 employees will have its network successfully penetrated once per week. Just for reference, _how many network penetrations does it take to deliver malware and compromise an entire organization? **One!**_ The numbers are actually worse than that. [Other research](https://www.darkreading.com/threat-intelligence/1-in-4-workers-are-aware-of-security-guidelines---but-ignore-them/d/d-id/1334492?%5Fmc=NL%5FDR%5FEDT%5FDR%5Fweekly%5F20190425&cid=NL%5FDR%5FEDT%5FDR%5Fweekly%5F20190425&elq%5Fmid=90687&elq%5Fcid=28171904) has shown that “_1 in 4 Workers Are Aware Of Security Guidelines, but Ignore Them._” That means to get phished once per week you only really need about eight highly-trained employees. [![Phishing Protection ](https://media.mailhop.org/duocircle/images/2019/08/SMTP-5056.jpg)](https://media.mailhop.org/duocircle/images/2019/08/SMTP-5056.jpg) You want to train your employees? Go ahead. But make it the first line of defense, not the last. _For the last line of defense, get something that protects your company from the 2% of links that get clicked_. Get [Phishing Protection](/email/phishing-protection) from DuoCircle. Phishing Protection from DuoCircle is cloud-based [email security solutions](/) with real-time link click protection. _DuoCircle doesn’t prevent human error, it protects your company when it inevitably happens_. ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) Brad Slavin General Manager General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio. ## Secure your email infrastructure Protect, authenticate, and deliver. Contact our team to find the right solution. [Contact Sales](/contact/) [Explore Products](/products/) Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Femail-hosting%2Fthe-frightening-math-of-security-awareness-training%2F) [ ](https://twitter.com/intent/tweet?text=The%20Frightening%20Math%20of%20Security%20Awareness%20Training&url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Femail-hosting%2Fthe-frightening-math-of-security-awareness-training%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Femail-hosting%2Fthe-frightening-math-of-security-awareness-training%2F) Copy Related Articles - [ ![setting up a self-hosted mail server](https://media.mailhop.org/duocircle/images/2026/03/spf-flatterning-5911.jpg) 10 Steps To Set Up A Self-Hosted Mail Server Without Hitting Spam Blog ](/blog/email-hosting/10-steps-set-up-self-hosted-mail-server-avoid-spam/) - [ ![Moving Mail to the Cloud](https://media.mailhop.org/duocircle/images/2016/04/spf-record-checker-4741.jpg) The 9 Ways You Benefit from Moving Mail to the Cloud Blog ](/blog/email-hosting/9-ways-benefit-moving-mail-cloud/) - [ Amazon Order Confirmation Trojan Blog ](/blog/email-hosting/amazon-order-confirmation-trojan/) - [ ![Zero-day Vulnerability](https://media.mailhop.org/duocircle/images/2021/12/smtp-relay-7593.jpg) Apache Log4j Zero-day Vulnerability: How to Detect it & Precautions You Need to Take Blog ](/blog/email-hosting/apache-log4j-zero-day-vulnerability-how-to-detect-it-precautions-you-need-to-take/) ## Related Articles [ Email Hosting 18m 10 Steps To Set Up A Self-Hosted Mail Server Without Hitting Spam Mar 10, 2026 ](/blog/email-hosting/10-steps-set-up-self-hosted-mail-server-avoid-spam/)[ Email Hosting 5m The 9 Ways You Benefit from Moving Mail to the Cloud Apr 13, 2016 ](/blog/email-hosting/9-ways-benefit-moving-mail-cloud/)[ Email Hosting 1m Amazon Order Confirmation Trojan Feb 16, 2019 ](/blog/email-hosting/amazon-order-confirmation-trojan/)[ Email Hosting 6m Apache Log4j Zero-day Vulnerability: How to Detect it & Precautions You Need to Take Dec 24, 2021 ](/blog/email-hosting/apache-log4j-zero-day-vulnerability-how-to-detect-it-precautions-you-need-to-take/) ```json {"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"The Frightening Math of Security Awareness Training","description":"It’s everywhere you turn. Advertisements for security awareness training. The last line of defense. The human firewall.","url":"https://www.duocircle.com/blog/email-hosting/the-frightening-math-of-security-awareness-training/","datePublished":"2019-08-29T13:20:57.000Z","dateModified":"2025-04-09T17:44:24.000Z","dateCreated":"2019-08-29T13:20:57.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/email-hosting/the-frightening-math-of-security-awareness-training/"},"articleSection":"email-hosting","keywords":"","wordCount":296,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2019/08/dmarc-report-5051.jpg","caption":"Security Awareness Training","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"Email Hosting"},{"@type":"ListItem","position":3,"name":"The Frightening Math of Security Awareness Training","item":"https://www.duocircle.com/blog/email-hosting/the-frightening-math-of-security-awareness-training/"}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"Email Hosting","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"The Frightening Math of Security Awareness Training","item":"https://www.duocircle.com/blog/email-hosting/the-frightening-math-of-security-awareness-training/"}]} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"The Frightening Math of Security Awareness Training","description":"It’s everywhere you turn. Advertisements for security awareness training. The last line of defense. The human firewall.","url":"https://www.duocircle.com/blog/email-hosting/the-frightening-math-of-security-awareness-training/","datePublished":"2019-08-29T13:20:57.000Z","dateModified":"2025-04-09T17:44:24.000Z","dateCreated":"2019-08-29T13:20:57.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/email-hosting/the-frightening-math-of-security-awareness-training/"},"articleSection":"email-hosting","keywords":"","wordCount":296,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2019/08/dmarc-report-5051.jpg","caption":"Security Awareness Training","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ```